2020 CVE Vulnerabilities
21,086 CVEs published in 2020.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2020-5654 | HIGH | 7.5 | 2.7% | Nov 2, 2020 | Session fixation vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP ... |
| CVE-2020-5653 | CRITICAL | 9.8 | 3.2% | Nov 2, 2020 | Buffer overflow vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP N... |
| CVE-2020-5652 | HIGH | 7.5 | 3.5% | Nov 2, 2020 | Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R, Q and L series CPU modules (R 00/01/02 ... |
| CVE-2020-28046 | HIGH | 7.8 | 0.5% | Nov 2, 2020 | An issue was discovered in ProlinOS through 2.4.161.8859R. An attacker with local code execution privileges as a normal ... |
| CVE-2020-28045 | HIGH | 7.8 | 0.4% | Nov 2, 2020 | An unsigned-library issue was discovered in ProlinOS through 2.4.161.8859R. This OS requires installed applications and ... |
| CVE-2020-28044 | MEDIUM | 6.8 | 0.3% | Nov 2, 2020 | An attacker with physical access to a PAX Point Of Sale device with ProlinOS through 2.4.161.8859R can boot it in manage... |
| CVE-2020-28043 | HIGH | 7.5 | 1.3% | Nov 2, 2020 | MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL. |
| CVE-2020-28042 | MEDIUM | 5.3 | 2.3% | Nov 2, 2020 | ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken functio... |
| CVE-2020-28041 | MEDIUM | 6.5 | 2.0% | Nov 2, 2020 | The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.64_10.2.64 devices allows remote attackers to communicate wi... |
| CVE-2020-28040 | MEDIUM | 4.3 | 1.1% | Nov 2, 2020 | WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. |
| CVE-2020-28039 | CRITICAL | 9.1 | 4.1% | Nov 2, 2020 | is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not p... |
| CVE-2020-28038 | MEDIUM | 6.1 | 2.6% | Nov 2, 2020 | WordPress before 5.5.2 allows stored XSS via post slugs. |
| CVE-2020-28037 | CRITICAL | 9.8 | 7.7% | Nov 2, 2020 | is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is alre... |
| CVE-2020-28036 | CRITICAL | 9.8 | 5.2% | Nov 2, 2020 | wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to... |
| CVE-2020-28035 | CRITICAL | 9.8 | 4.2% | Nov 2, 2020 | WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. |
| CVE-2020-28034 | MEDIUM | 6.1 | 1.7% | Nov 2, 2020 | WordPress before 5.5.2 allows XSS associated with global variables. |
| CVE-2020-28033 | HIGH | 7.5 | 2.6% | Nov 2, 2020 | WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam ... |
| CVE-2020-28032 | CRITICAL | 9.8 | 16.1% | Nov 2, 2020 | WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. |
| CVE-2020-28031 | MEDIUM | 4.3 | 0.6% | Nov 2, 2020 | eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenti... |
| CVE-2020-28030 | HIGH | 7.5 | 2.0% | Nov 2, 2020 | In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by co... |
| CVE-2020-28002 | MEDIUM | 5.3 | 1.1% | Nov 2, 2020 | In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty val... |
| CVE-2020-27992 | HIGH | 7.8 | 0.4% | Nov 2, 2020 | Dr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because %PROGRAMFILES(X86)%\Won... |
| CVE-2020-27982 | MEDIUM | 6.1 | 5.3% | Nov 2, 2020 | IceWarp 11.4.5.0 allows XSS via the language parameter. |
| CVE-2020-27708 | HIGH | 7.8 | 0.6% | Nov 2, 2020 | A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either... |
| CVE-2020-27359 | MEDIUM | 5.4 | 0.8% | Nov 2, 2020 | A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScrip... |
Check if your code is affected by 2020 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now